Hacker News Reader

Quote from the article:

"StartSSL already refused to revoke certificates affected by the HeartBleed vulnerability and accused the user from negligence."

That's wrong. They did charge a $25 fee for the revocation, however. I think it's reasonable since there is probably some manual process involved and the certificate was already free. They have to earn money somehow.

View on HN

Exactly, they've automated the issuance of free certs and revoking takes extra work. $25 sounds high (sub-$10/year certs with unlimited free revocation & re-issuance are easy to find) so it is a money maker for them but so what?

People think nothing of using the freemium model which gives you a basic product for free, and charges you for extra features. It's exactly what StartSSL are doing here.

I don't particularly like or use StartSSL, but much of the criticism of them sounds totally invalid to me. Paid DV certs are dirt cheap people, shop around!

Except that it causes that a startSSL certificate had a higher chance of being unrevoked if compromised. Therefore, I remove them from the truststore on my computers.

Reply on news.ycombinator.com